nervur 0.20.0 → 0.20.2

package/dist/ward/stance.js

@@ -4,7 +4,7 @@
 // standing, one send at a time, inside her allowance.
 import { readValue, writeValue } from '../crypto/index.js';
 import { readInvitation, Standing as Wire, freshStanding } from '../quo/index.js';
-import { OWNER, silence, word } from '../being/index.js';
+import { OWNER, ownKind, silence, word } from '../being/index.js';
 import { allow, Bell, LATE } from './allowance.js';
 import { Cells, DEPTH } from './cells.js';
 export { DEPTH };
@@ -65,18 +65,19 @@ export class WardStance {
     get #live() {
         return this.#inside.live(this.key, this.#row);
     }
-    boot(className, key, id) {
-        return this.#live ? this.#inside.boot(this.key, className, key, id) : Promise.resolve(null);
+    boot(kind, key, id) {
+        return this.#live ? this.#inside.boot(this.key, kind, key, id) : Promise.resolve(null);
     }
     async lend(contract, id) {
-        if (!this.#free(id, this.#row.standings))
+        const kind = ownKind(contract);
+        if (kind === undefined || !this.#free(id, this.#row.standings))
             return null;
-        const invitation = await this.#inside.offer(contract.name);
+        const invitation = await this.#inside.offer(kind);
         if (invitation === null)
             return null;
         const taken = await this.#take(id, invitation);
         if (taken === null)
-            await this.#inside.retract(contract.name, invitation.heir);
+            await this.#inside.retract(kind, invitation.heir);
         return taken;
     }
     #free(id, of) {
@@ -86,7 +87,7 @@ export class WardStance {
         const kept = writeValue(notes, DEPTH);
         if (!this.#free(id, this.#row.occupants) || kept === undefined)
             return null;
-        const { heir, invitation } = await this.#inside.door.invite();
+        const { heir, invitation } = await this.#inside.door.invite(this.#inside.reach());
         if (!this.#free(id, this.#row.occupants)) {
             this.#inside.door.remove(heir);
             return null;
@@ -112,6 +113,8 @@ export class WardStance {
         const invitation = readInvitation(value);
         if (!invitation || !this.#free(id, this.#row.standings))
             return null;
+        if (invitation.at)
+            await this.#inside.learn(invitation.ward, invitation.at);
         const wire = new Wire(invitation, freshStanding(), this.#inside.draw);
         const read = await this.#lanes.run(`take:${id}`, async () => {
             // A knock that brought nothing back may have bound: the standing asks

package/dist/ward/ward-being.d.ts

@@ -18,7 +18,10 @@ export type WardBeingStance = Stance & {
 };
 export declare const pilots: (asker: Asker, notes: JsonObject | undefined) => boolean;
 export declare const ownerAsk: (description: string, input?: JsonObject) => AskSpec;
+export declare const rootAsk: (description: string, input?: JsonObject) => AskSpec;
+export declare const PILOT = "org.nervur.pilot";
 export declare class WardBeing extends Being {
+    static readonly kind: string;
     static asks: Record<string, AskSpec>;
     readonly steward: Steward;
     constructor(stance: WardBeingStance);
@@ -26,7 +29,7 @@ export declare class WardBeing extends Being {
     own(args: JsonObject): Promise<JsonObject>;
     disown(args: JsonObject): JsonObject;
     boot(args: JsonObject): Promise<JsonObject>;
-    unboot(args: JsonObject): JsonObject;
+    unboot(args: JsonObject): JsonObject | Promise<JsonObject>;
     public(args: JsonObject): JsonObject;
     invite(args: JsonObject): Promise<JsonObject>;
     ask(args: JsonObject): Promise<JsonObject>;

package/dist/ward/ward-being.js

@@ -1,7 +1,7 @@
 // SPDX-License-Identifier: Apache-2.0
 // The ward-being: the first being of every ward, the ward itself. Her asks
 // are the root's, shown and answered to `OWNER` alone.
-import { Being, isSilence, isWord, OWNER, told } from '../being/index.js';
+import { Being, isSilence, isWord, KIT, OWNER, told } from '../being/index.js';
 // Whoever pilots a ward: the root, holding its unsealed ask, or an owner,
 // an occupant of the ward-being the root invited as one.
 export const pilots = (asker, notes) => asker.id === OWNER || notes?.owner === true;
@@ -9,10 +9,14 @@ export const pilots = (asker, notes) => asker.id === OWNER || notes?.owner === t
 export const ownerAsk = (description, input = {}) => ({ description, input: { type: 'object', ...input }, for: pilots });
 // An ask the root alone may make, so a carried key pilots but never hands
 // piloting on.
-const rootAsk = (description, input = {}) => ({ description, input: { type: 'object', ...input }, for: (asker) => asker.id === OWNER });
+export const rootAsk = (description, input = {}) => ({ description, input: { type: 'object', ...input }, for: (asker) => asker.id === OWNER });
+// The one kit kind the root boots: every other kit class stands where the
+// kit puts it.
+export const PILOT = 'org.nervur.pilot';
 const text = (v) => typeof v === 'string';
 const object = (v) => typeof v === 'object' && v !== null && !Array.isArray(v);
 export class WardBeing extends Being {
+    static kind = 'org.nervur.ward-being';
     static asks = {
         boot: ownerAsk('a new being of this ward', { required: ['key', 'class'] }),
         unboot: ownerAsk('a being out, with every relation she holds', { required: ['being'] }),
@@ -45,6 +49,8 @@ export class WardBeing extends Being {
     async boot(args) {
         if (!text(args.key) || !text(args.class))
             return { error: 'key and class are text' };
+        if (args.class.startsWith(KIT) && args.class !== PILOT)
+            return { error: 'no such class' };
         const out = await this.steward.boot(args.key, args.class);
         return out === 'booted' ? { booted: args.key } : { error: out };
     }

package/dist/ward/ward.d.ts

@@ -1,11 +1,11 @@
 import { Door, WardKey, type Behind, type Choice, type Invitation, type Payload } from '../quo/index.ts';
 import type { Carrier, Clock, Entropy, Rows } from '../contract/index.ts';
-import { type Answer, type BeingClass, type JsonObject } from '../being/index.ts';
+import { type Answer, type BeingClass, type BeingLike, type JsonObject } from '../being/index.ts';
 import { Partition, type BeingRow } from './partition.ts';
 import { type Inside } from './stance.ts';
 import { WardBeing, type WardBeingStance } from './ward-being.ts';
 export interface Catalogue {
-    classOf(name: string): BeingClass | undefined;
+    classOf(kind: string): BeingClass | undefined;
 }
 export type WardParts = {
     readonly seed: Uint8Array | string;
@@ -16,7 +16,12 @@ export type WardParts = {
     readonly carrier: Carrier;
     readonly root?: (stance: WardBeingStance) => WardBeing;
     readonly dock?: Invitation;
+    readonly routes?: Routes;
 };
+export interface Routes {
+    reach(): readonly string[];
+    learn(ward: string, at: readonly string[]): Promise<void>;
+}
 export declare const DOCK = "dock";
 export interface Lender {
     offer(contract: string): Promise<Invitation | null>;
@@ -33,12 +38,16 @@ export declare class Ward implements Behind, Inside {
     get pk(): string;
     get draw(): import("../quo/keys.ts").Draw;
     get wardBeing(): WardBeing;
+    being(key: string): BeingLike | undefined;
+    bearAnew(): void;
     root(method?: string, args?: JsonObject): Promise<Answer>;
     get zero(): boolean;
     answer(heir: string | null, p: Payload): Promise<Choice>;
     send(pk: string, bytes: Uint8Array): Promise<Uint8Array | null>;
     offer(contract: string): Promise<Invitation | null>;
     retract(contract: string, heir: string): Promise<void>;
+    reach(): readonly string[];
+    learn(ward: string, at: readonly string[]): Promise<void>;
     live(key: string, row: BeingRow): boolean;
     boot(maker: string, className: string, key: string, id?: string): Promise<string | null>;
 }

package/dist/ward/ward.js

@@ -5,7 +5,7 @@
 // what is behind its door for `quo/`.
 import { readValue, writeValue } from '../crypto/index.js';
 import { Door, readInvitation, WardKey } from '../quo/index.js';
-import { digest, isSilence, isWord, OWNER, silence, WARD, word } from '../being/index.js';
+import { digest, isSilence, isWord, kindOf, OWNER, silence, WARD, word } from '../being/index.js';
 import { Partition, PartitionRelations } from './partition.js';
 import { DEPTH, WardStance } from './stance.js';
 import { WardBeing } from './ward-being.js';
@@ -47,10 +47,13 @@ export class Ward {
         const own = ward.partition.being(WARD);
         const stance = new RootStance(ward, own, ward.#steward);
         const being = parts.root ? parts.root(stance) : new WardBeing(stance);
-        own.class = being.constructor.name;
+        own.class = kindOf(being.constructor);
         ward.#residents.set(WARD, { being, row: own, stance });
-        if (parts.dock && !Object.hasOwn(own.standings, DOCK))
-            await stance.standings.take(DOCK, parts.dock);
+        // The standing on the dock is kept at once: its heir is spent, so a
+        // restart before the ward's first keep would find no way back.
+        if (parts.dock && !Object.hasOwn(own.standings, DOCK) && (await stance.standings.take(DOCK, parts.dock)) !== null && !(await ward.partition.kept())) {
+            throw new Error('the standing on the dock was not kept');
+        }
         for (const [key, row] of Object.entries(ward.partition.beings)) {
             const C = key === WARD ? undefined : parts.catalogue.classOf(row.class);
             if (C)
@@ -67,6 +70,33 @@ export class Ward {
     get wardBeing() {
         return this.#residents.get(WARD).being;
     }
+    // The being standing under a key, for the harbor's own faculties.
+    being(key) {
+        return this.#residents.get(key)?.being;
+    }
+    // Every being her row names, of the class the catalogue now resolves for
+    // her kind: an absent being is born, and one whose class a module
+    // replaced is born again of the new class on the stance she holds, so
+    // her relations and their lanes stay hers. A new class that throws at
+    // birth leaves her as she was.
+    bearAnew() {
+        for (const [key, row] of Object.entries(this.partition.beings)) {
+            const C = key === WARD ? undefined : this.#parts.catalogue.classOf(row.class);
+            const resident = this.#residents.get(key);
+            if (!C || resident?.being.constructor === C)
+                continue;
+            if (!resident) {
+                this.#bear(key, row, C);
+                continue;
+            }
+            try {
+                resident.being = new C(resident.stance);
+            }
+            catch {
+                continue;
+            }
+        }
+    }
     // The unsealed ask: the ward-being, asked by whoever holds this ward.
     async root(method, args = {}) {
         return this.#kept(WARD, () => this.#answer(WARD, { id: OWNER }, method, args));
@@ -89,7 +119,7 @@ export class Ward {
         }
         return silence;
     }
-    // Behind: the zero head reaches the public being, a heir the being that
+    // Behind: the zero head reaches the public being, an heir the being that
     // invited it.
     get zero() {
         const key = this.partition.head.public;
@@ -147,6 +177,12 @@ export class Ward {
             return own.being.withdraw(contract, heir);
         await own.stance.standings.get(DOCK)?.ask('retract', { contract, heir });
     }
+    reach() {
+        return this.#parts.routes?.reach() ?? [];
+    }
+    learn(ward, at) {
+        return this.#parts.routes?.learn(ward, at) ?? Promise.resolve();
+    }
     live(key, row) {
         return this.#residents.get(key)?.row === row;
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "nervur",
-  "version": "0.20.0",
+  "version": "0.20.2",
   "description": "Nervur's kit of Quo: an object asks another object and gets an answer, without knowing where it is.",
   "keywords": [
     "quo",
@@ -12,21 +12,47 @@
   "license": "Apache-2.0",
   "homepage": "https://nervur.org",
   "type": "module",
+  "bin": {
+    "nervur": "dist/cli/main.js"
+  },
   "exports": {
     ".": {
       "types": "./dist/index.d.ts",
+      "workerd": "./dist/edge.js",
+      "browser": "./dist/browser.js",
+      "node": "./dist/node.js",
       "default": "./dist/index.js"
     },
+    "./edge": {
+      "types": "./dist/edge/index.d.ts",
+      "default": "./dist/edge/index.js"
+    },
+    "./browser": {
+      "types": "./dist/browser/index.d.ts",
+      "default": "./dist/browser/index.js"
+    },
+    "./node": {
+      "types": "./dist/node/index.d.ts",
+      "default": "./dist/node/index.js"
+    },
     "./folder": {
       "types": "./dist/folder/index.d.ts",
       "default": "./dist/folder/index.js"
+    },
+    "./tcp": {
+      "types": "./dist/tcp/index.d.ts",
+      "default": "./dist/tcp/index.js"
+    },
+    "./http": {
+      "types": "./dist/http/index.d.ts",
+      "default": "./dist/http/index.js"
     }
   },
   "scripts": {
     "build": "tsc -p tsconfig.build.json",
     "check": "tsc -p tsconfig.json && npm run build && node ../../test.mjs \"test/unit/*.test.ts\" \"test/e2e/*.test.ts\"",
     "deep": "node ../../test.mjs \"test/terrain/*.test.ts\"",
-    "cover": "node --test --test-timeout=60000 --experimental-test-coverage --test-coverage-exclude=\"**/dist/**\" --test-coverage-exclude=\"**/test/**\" --test-coverage-exclude=\"**/src/stand/**\" --test-coverage-exclude=\"../../quo/**\" --test-coverage-lines=99 --test-coverage-branches=93 --test-coverage-functions=95 \"test/unit/*.test.ts\" \"test/e2e/*.test.ts\"",
+    "cover": "node --test --test-timeout=60000 --experimental-test-coverage --test-coverage-exclude=\"**/dist/**\" --test-coverage-exclude=\"**/test/**\" --test-coverage-exclude=\"**/src/stand/**\" --test-coverage-exclude=\"**/src/browser/**\" --test-coverage-exclude=\"**/src/edge/**\" --test-coverage-exclude=\"../../quo/**\" --test-coverage-lines=99 --test-coverage-branches=93 --test-coverage-functions=95 \"test/unit/*.test.ts\" \"test/e2e/*.test.ts\"",
     "prepublishOnly": "test \"$NERVUR_GATED\" = 1 || { echo 'a publish is /release, from the root, on the human'\"'\"'s word' >&2; exit 1; }"
   },
   "engines": {

package/src/being/being.ts

@@ -28,8 +28,12 @@ const wrote = (self: object, name: string): boolean => {
 type Method = (args: JsonObject, asker: Asker) => Reply | Promise<Reply>;
 
 // A subclass's statics replace its parent's and never merge: her blueprint
-// is what the class in front of you declares, in its order.
+// is what the class in front of you declares, in its order. Her kind is
+// never inherited: see `kind.ts`.
 export class Being {
+  // The name her row keeps for this class. Every class that stands declares
+  // its own.
+  static readonly kind: string = 'org.nervur.being';
   // Her cells' defaults, written at birth only where a key is missing.
   static cells: JsonObject = {};
   static asks: Record<string, AskSpec> = {};

package/src/being/faculty.ts

@@ -2,23 +2,30 @@
 // A faculty: a being of the box ward that fulfils a contract. A contract is
 // a class between `Faculty` and the class that stands, usually abstract:
 //
-//   abstract class Timer extends Faculty { ... }     the contract
-//   class IntervalTimer extends Timer { ... }        one class that fulfils it
+//   abstract class Timer extends Faculty {           the contract
+//     static override kind = 'com.acme.timer' }
+//   class IntervalTimer extends Timer {              one class that fulfils it
+//     static override kind = 'com.acme.interval-timer' }
 //
-// A being lends by the contract and never learns the class. Two asks are the
+// A being lends by the contract's kind and never learns the class. Every
+// class between the faculty and `Faculty` is a contract and declares its
+// own kind, and a faculty fulfils each of them and her own. Two asks are the
 // faculty's own and answered to the ward-being that opened her alone:
 // `offer`, an invitation on herself for a ward the dock vouches for, and
 // `retract`, an offer that was not taken.
 import { Being } from './being.ts';
+import { kindOf } from './kind.ts';
 import { WARD, type Asker, type Blueprint, type JsonObject, type Reply } from './types.ts';
 
 export class Faculty extends Being {
+  static override readonly kind: string = 'org.nervur.faculty';
+
   // The contracts a class fulfils: itself and every class between it and
-  // `Faculty`, by name.
+  // `Faculty`, by kind. A class among them with no kind of its own throws.
   static contracts(C: abstract new (...args: never[]) => unknown): string[] {
-    const names: string[] = [];
-    for (let c: unknown = C; typeof c === 'function' && c !== Faculty; c = Object.getPrototypeOf(c)) names.push((c as { name: string }).name);
-    return names;
+    const kinds: string[] = [];
+    for (let c: unknown = C; typeof c === 'function' && c !== Faculty; c = Object.getPrototypeOf(c)) kinds.push(kindOf(c));
+    return kinds;
   }
 
   static fulfils(C: unknown): C is typeof Faculty {

package/src/being/index.ts

@@ -3,5 +3,6 @@
 export { Being, type AskSpec } from './being.ts';
 export { canonical, digest } from './digest.ts';
 export { Faculty } from './faculty.ts';
+export { isKind, KIT, kindOf, ownKind } from './kind.ts';
 export { OWNER, WARD, type Answer, type Ask, type Asker, type BeingClass, type BeingLike, type Blueprint, type Invitation, type Json, type JsonObject, type Occupants, type Reply, type Schema, type Stance, type Standing, type Standings, type Wanted } from './types.ts';
 export { isSilence, isWord, silence, told, word, type Silence, type Word, type WordName } from './words.ts';

package/src/being/kind.ts

@@ -0,0 +1,30 @@
+// SPDX-License-Identifier: Apache-2.0
+// A kind: the name a row keeps for the class a being is born of, and the
+// name a contract is lent by. It is declared on the class, never taken from
+// the name the language gives it, because a bundler renames classes.
+//
+//   static kind = 'com.acme.shop'
+//
+// A kind is a reversed domain its author owns, then a name: at least three
+// segments joined by `.`, each lowercase letters, digits and `-`, starting
+// with a letter or digit. `org.nervur.` is the kit's own. A class declares
+// its own kind: one it inherits names its parent, so it is none.
+export const KIT = 'org.nervur.';
+
+const KIND = /^[a-z0-9][a-z0-9-]*(?:\.[a-z0-9][a-z0-9-]*){2,}$/;
+
+export const isKind = (text: unknown): text is string => typeof text === 'string' && KIND.test(text);
+
+// The kind a class declares on itself, or undefined.
+export const ownKind = (C: unknown): string | undefined => {
+  if (typeof C !== 'function' || !Object.hasOwn(C, 'kind')) return undefined;
+  const kind = (C as { kind?: unknown }).kind;
+  return isKind(kind) ? kind : undefined;
+};
+
+// The kind a class declares on itself, or a throw naming the class.
+export const kindOf = (C: unknown): string => {
+  const kind = ownKind(C);
+  if (kind === undefined) throw new Error(`class ${typeof C === 'function' ? C.name : String(C)} declares no kind of its own`);
+  return kind;
+};

package/src/being/types.ts

@@ -56,12 +56,13 @@ export interface Stance {
   readonly cells: JsonObject;
   readonly occupants: Occupants;
   readonly standings: Standings;
-  // A new being of her ward, by class name, under a key she chooses. With an
-  // id, the new being invites her under her key, and she takes it under id.
-  boot(className: string, key: string, id?: string): Promise<string | null>;
+  // A new being of her ward, by kind, under a key she chooses. With an id,
+  // the new being invites her under her key, and she takes it under id.
+  boot(kind: string, key: string, id?: string): Promise<string | null>;
   // A standing under `id` at the faculty this harbor opened for a contract:
-  // the id, or null where none is open or the relation was refused.
-  lend(contract: { readonly name: string }, id: string): Promise<string | null>;
+  // the id, or null where none is open, the contract declares no kind of
+  // its own, or the relation was refused.
+  lend(contract: abstract new (...args: never[]) => unknown, id: string): Promise<string | null>;
 }
 
 // Anything with `answer` is a being.
@@ -69,4 +70,5 @@ export interface BeingLike {
   answer(asker: Asker, method: string | undefined, args: JsonObject): Reply | Promise<Reply>;
   describe?(asker: Asker): Blueprint;
 }
-export type BeingClass = (new (stance: Stance) => BeingLike) & { readonly name: string };
+// A class that stands. Its kind is its own, as `kind.ts` says.
+export type BeingClass = (new (stance: Stance) => BeingLike) & { readonly name: string; readonly kind: string };

package/src/browser/index.ts

@@ -0,0 +1,207 @@
+// SPDX-License-Identifier: Apache-2.0
+// `nervur/browser`: the browser ground, in a page or a worker. A harbor
+// keeps its sealed memory and its seed in one IndexedDB database, named
+// by `where`, speaks the web, and holds its database to one run with a
+// Web Lock of the same name.
+//
+//   entries   one sealed entry per key [place, name]
+//   custody   the seed, sealed under an AES-GCM key the engine never
+//             hands out, itself kept as the engine keeps a CryptoKey
+//
+// A keep is one transaction, so it is whole or nothing by IndexedDB's own
+// rule.
+import { Custody, Memory, type Entropy, type Module } from '../contract/index.ts';
+import type { GroundProbe } from '../harbor/index.ts';
+import { webFaculty, WEB_OPENING, webPush } from '../line/index.ts';
+import { CryptoEntropy, HeldLoader, PointerTerrain } from '../pointer/index.ts';
+
+export { ringAll, rootOf, serveWorker, type Reaching } from './worker.ts';
+
+export const BROWSER = 'browser';
+// The database a harbor keeps itself in unless named.
+export const BROWSER_HARBOR = 'nervur';
+
+const ENTRIES = 'entries';
+const CUSTODY = 'custody';
+const SEED = 'seed';
+// Past every lowercase hex name, so [place, END] bounds a place's keys.
+const END = '￿';
+
+type Sealed = { key: CryptoKey; iv: Uint8Array<ArrayBuffer>; sealed: ArrayBuffer };
+
+const done = <T>(request: IDBRequest<T>): Promise<T> =>
+  new Promise((resolve, reject) => {
+    request.onsuccess = () => resolve(request.result);
+    request.onerror = () => reject(request.error ?? new Error('IndexedDB refused'));
+  });
+
+// A transaction's end. A request that fails aborts it, and the abort
+// carries that request's error.
+const finished = (tx: IDBTransaction): Promise<void> =>
+  new Promise((resolve, reject) => {
+    tx.oncomplete = () => resolve();
+    tx.onabort = () => reject(tx.error ?? new Error('the keep was aborted'));
+  });
+
+// One database, opened once per body and made on first open.
+class Database {
+  readonly name: string;
+  #open: Promise<IDBDatabase> | undefined;
+  constructor(name: string) {
+    this.name = name;
+  }
+  get(): Promise<IDBDatabase> {
+    this.#open ??= new Promise((resolve, reject) => {
+      const request = indexedDB.open(this.name, 1);
+      request.onupgradeneeded = () => {
+        request.result.createObjectStore(ENTRIES);
+        request.result.createObjectStore(CUSTODY);
+      };
+      request.onsuccess = () => resolve(request.result);
+      request.onerror = () => reject(request.error ?? new Error(`${this.name} did not open`));
+    });
+    return this.#open;
+  }
+  async close(): Promise<void> {
+    const open = this.#open;
+    this.#open = undefined;
+    if (open) (await open).close();
+  }
+}
+
+export class IdbMemory extends Memory {
+  readonly #db: Database;
+  constructor(name: string = BROWSER_HARBOR) {
+    super();
+    this.#db = new Database(name);
+  }
+
+  // The database it keeps in.
+  get name(): string {
+    return this.#db.name;
+  }
+
+  async read(place: string): Promise<Map<string, Uint8Array>> {
+    const store = (await this.#db.get()).transaction(ENTRIES).objectStore(ENTRIES);
+    const range = IDBKeyRange.bound([place, ''], [place, END]);
+    const [keys, values] = await Promise.all([done(store.getAllKeys(range)), done(store.getAll(range))]);
+    return new Map(keys.map((key, i) => [(key as [string, string])[1], new Uint8Array(values[i] as ArrayBuffer)]));
+  }
+
+  async write(place: string, entries: ReadonlyMap<string, Uint8Array | null>): Promise<void> {
+    const tx = (await this.#db.get()).transaction(ENTRIES, 'readwrite');
+    const kept = finished(tx);
+    const store = tx.objectStore(ENTRIES);
+    try {
+      for (const [name, bytes] of entries) this.put(store, [place, name], bytes === null ? null : bytes.slice().buffer);
+    } catch (e) {
+      tx.abort();
+      await kept.catch(() => undefined);
+      throw e;
+    }
+    await kept;
+  }
+
+  // One entry of a keep: its bytes, or null where it goes.
+  protected put(store: IDBObjectStore, key: [string, string], bytes: ArrayBuffer | null): void {
+    if (bytes === null) store.delete(key);
+    else store.put(bytes, key);
+  }
+
+  async places(): Promise<string[]> {
+    const keys = await done((await this.#db.get()).transaction(ENTRIES).objectStore(ENTRIES).getAllKeys());
+    return [...new Set(keys.map((key) => (key as [string, string])[0]))];
+  }
+
+  async forget(place: string): Promise<void> {
+    const tx = (await this.#db.get()).transaction(ENTRIES, 'readwrite');
+    tx.objectStore(ENTRIES).delete(IDBKeyRange.bound([place, ''], [place, END]));
+    await finished(tx);
+  }
+
+  close(): Promise<void> {
+    return this.#db.close();
+  }
+}
+
+export class IdbCustody extends Custody {
+  readonly #db: Database;
+  readonly #entropy: Entropy;
+  constructor(name: string = BROWSER_HARBOR, entropy: Entropy = new CryptoEntropy()) {
+    super();
+    this.#db = new Database(name);
+    this.#entropy = entropy;
+  }
+
+  // The seed the database holds, or a drawn one sealed there the first
+  // time. Two first asks at once keep the one added first.
+  async seed(): Promise<Uint8Array> {
+    const db = await this.#db.get();
+    const kept = (await done(db.transaction(CUSTODY).objectStore(CUSTODY).get(SEED))) as Sealed | undefined;
+    if (kept) return new Uint8Array(await crypto.subtle.decrypt({ name: 'AES-GCM', iv: kept.iv }, kept.key, kept.sealed));
+    const seed = this.#entropy.draw(32);
+    const key = await crypto.subtle.generateKey({ name: 'AES-GCM', length: 256 }, false, ['encrypt', 'decrypt']);
+    const iv = new Uint8Array(this.#entropy.draw(12));
+    const sealed = await crypto.subtle.encrypt({ name: 'AES-GCM', iv }, key, new Uint8Array(seed));
+    const tx = db.transaction(CUSTODY, 'readwrite');
+    tx.objectStore(CUSTODY).add({ key, iv, sealed } satisfies Sealed, SEED);
+    try {
+      await finished(tx);
+    } catch (e) {
+      if ((e as { name?: string }).name === 'ConstraintError') return this.seed();
+      throw e;
+    }
+    return seed;
+  }
+
+  close(): Promise<void> {
+    return this.#db.close();
+  }
+}
+
+export type BrowserParts = { readonly where?: string; readonly modules?: readonly Module[] };
+
+// A harbor of the browser: its database, the web opened at genesis, Web
+// Push beside it, and one run to a database, held by a Web Lock where the
+// engine has them.
+export class BrowserTerrain extends PointerTerrain {
+  readonly where: string;
+  #release: (() => void) | undefined;
+
+  constructor(parts: BrowserParts = {}) {
+    const where = parts.where ?? BROWSER_HARBOR;
+    const entropy = new CryptoEntropy();
+    super({ entropy, loader: new HeldLoader(parts.modules ?? []), custody: new IdbCustody(where, entropy), memory: new IdbMemory(where), faculties: [webFaculty(), webPush], opens: [WEB_OPENING] });
+    this.where = where;
+  }
+
+  override async claim(): Promise<void> {
+    const locks = (globalThis as { navigator?: { locks?: LockManager } }).navigator?.locks;
+    if (!locks) return;
+    const held = await new Promise<boolean>((granted) => {
+      void locks.request(`nervur:${this.where}`, { ifAvailable: true }, (lock) => {
+        if (lock === null) {
+          granted(false);
+          return undefined;
+        }
+        granted(true);
+        return new Promise<void>((release) => (this.#release = release));
+      });
+    });
+    if (!held) throw new Error(`a harbor is already open on ${this.where}`);
+  }
+
+  override async release(): Promise<void> {
+    this.#release?.();
+    this.#release = undefined;
+    await (this.memory as IdbMemory).close();
+    await (this.custody as IdbCustody).close();
+  }
+}
+
+// A page or a worker with IndexedDB and Web Crypto.
+export const browserGround: GroundProbe = {
+  name: BROWSER,
+  fits: () => typeof indexedDB !== 'undefined' && typeof crypto?.subtle !== 'undefined',
+  terrain: ({ modules, where }) => new BrowserTerrain({ ...(where ? { where } : {}), ...(modules ? { modules } : {}) }),
+};